« The How-To for html 5 parsing | Main | Getting closer to a standard for client-side cross-site requests »
life without MIME type sniffing?
In a recent item on IE8 Security, Eric Lawrence, Security Program Manager for Internet Explorer, introduced a work-around to the security risks associated with content-type sniffing: an authoritative=true parameter on the Content-Type header in HTTP. This re-started discussion of the content-type sniffing rules and the Support Existing Content design principle of HTML 5. In response to a challenge asking for evidence that supporting existing content requires sniffing, Adam made a suggestion that I'd like to pass along:
I encourage you to build a copy of Firefox without content sniffing and try surfing the web. I tried this for a while, and I remember there being a lot of broken sites ...
That reminded me of an idea I heard in TAG discussions of MIME types and error recovery: a browser mode for "This is my content, show me problems rather than fixing them for me silently."
Though Adam offered a patch, building firefox is not something I have mastered yet, so I'm interested to learn about run-time configuration options in IE (notes Julian) and Opera (notes Michael). Eric Lawrence's reply points out:
Please do keep in mind, however, that most folks (even the ultra-web engaged on these lists) see but a small fraction of the web, especially considering private address space/intranets, etc.
A report from one developer suggests there's light at the end of the tunnel, at least for sniffing associated with feeds:
I did, partly as an experiment, stop sniffing text/plain in the latest release of SimplePie (which, inevitably, isn't the nicest of things to do, seeming there are tens of thousands of users). Next to nothing broke. I know for a fact this couldn't have been done a year or two ago: things have certainly moved on in terms of the MIME types feeds are served with ...
If you get a chance to try life without MIME type sniffing, please let us know how it goes.
Filed by Dan Connolly on July 7, 2008 5:19 PM in Bugs Life, HTML, Web Architecture
| Permalink
| Comments (1)
| TrackBacks (0)
Comments
Leave a comment
Note: this blog is intended to foster polite on-topic discussions. Comments failing these requirements and spam will not get published. Please, enter your real name and email address. Every individual comment is reviewed by the W3C staff. This may take some time, thank you for your patience.
You can use the following HTML markup (a href, b, i, br/, p, strong, em, ul, ol, li, blockquote, pre) and/or Markdown syntax.
Also, to say something I said later in that email (that Dan didn't quote), text/html sniffing (to see whether it is a feed or HTML) is certainly needed still, but as far as I've seen, that's the only bit of sniffing still needed (the other thing needed with regard to content-type on HTTP needed still is to only use the last Content-Type header, and to not concatenate them together as you would normally). The only sniffing I think can now be done without is (most) text/plain sniffing (you still need to have special treatment if it isn't the character set it claims to be).